CVE-2026-108878

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the AiragAppController queryById handler. This vulnerability allows low-privileged authenticated users to access the configurations of other users' AI applications. Specifically, attackers can enumerate application...

EUVD-2026-97052

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and...

EUVD-2026-96552

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens...

CVE-2026-108613

Versions of JeecgBoot through 3.9.5 are affected by a missing authorization vulnerability within the AiragAppController release handler. This flaw allows any authenticated user to perform unauthorized actions on other users' AI applications. Specifically, a low-privileged attacker can send POST r...